FDA’s generative AI consultation closes: What should medical device manufacturers do next?

As the FDA considers how generative artificial intelligence should be regulated within medical devices, manufacturers face a growing challenge: demonstrating that systems capable of variable and evolving outputs remain safe, effective and under adequate control throughout their lifecycle.

The US Food and Drug Administration (FDA) has reached an important milestone in its consideration of generative artificial intelligence (GenAI)-enabled medical devices. The agency's public feedback period closed on 19 October 2026, following publication of its discussion paper on 18 August. The consultation, led by the FDA's Digital Health Center of Excellence, sought views from manufacturers, clinicians, researchers and other stakeholders on risk assessment, premarket evaluation and postmarket monitoring.

Importantly, the discussion paper is not a new regulation or final guidance. Rather, it provides an indication of the questions the FDA is considering as it develops an appropriate regulatory approach to GenAI-enabled technologies.

Why generative AI presents a different challenge

GenAI does not necessarily behave like conventional medical-device software. Such systems may accept open-ended inputs, undertake multiple subtasks and generate variable outputs from similar inputs. This complicates traditional approaches to verification and validation, where manufacturers seek to establish predictable performance against predefined specifications.

The FDA discussion therefore points towards risk-proportionate oversight. One concept under consideration is a two-axis approach to risk assessment, alongside competency-based approaches to premarket evaluation.

For manufacturers, the practical implication is that demonstrating satisfactory performance prior to market entry may not be enough. An AI system's behaviour in its intended clinical environment and its performance through the product lifecycle are likely to become increasingly important considerations.

This makes postmarket monitoring particularly significant. Manufacturers should consider how changes in performance can be detected, investigated and controlled, and how evidence generated after deployment feeds back into the product's risk-management process.

Compliance becomes increasingly important

These discussions also coincide with a potentially significant change in the US enforcement environment.

On 1 October, the Department of Justice issued Directive 26-12, Corporate Enforcement in the Fight Against Fraud. The directive calls for an “all-tools” approach towards specified fraud priorities and explicitly includes healthcare fraud, controlled-substance distribution and violations of the Federal Food, Drug, and Cosmetic Act among priority areas.

Legal commentators consequently suggest that FDA-regulated pharmaceutical and medical-device companies could face enhanced scrutiny. This does not mean that every regulatory deficiency will result in DOJ action, but it reinforces the value of effective compliance systems, internal controls, investigation processes and timely remediation.

What should manufacturers do now?

The FDA has not yet established final GenAI-specific requirements, so companies should avoid treating the concepts in the discussion paper as settled regulatory expectations. Nevertheless, manufacturers can prepare.

A sensible starting point is to examine existing quality and risk-management systems against the particular characteristics of GenAI. This should include clearly defining intended use, identifying safety-critical outputs and foreseeable failure modes, determining how performance will be challenged before deployment, and establishing appropriate mechanisms for detecting deterioration or unexpected behaviour afterwards.

Change control will be another critical consideration. Organisations will need to understand what aspects of an AI-enabled device may change, how those changes could affect validated performance and when additional assessment becomes necessary.

The central message is therefore familiar to pharmaceutical and medical-device quality professionals: innovation does not remove the requirement for control. As GenAI becomes increasingly sophisticated, evidence of lifecycle governance, risk management, monitoring and effective quality oversight is likely to be just as important as the sophistication of the algorithm itself.

Posted by Dr. Tim Sandle, Pharmaceutical Microbiology Resources (http://www.pharmamicroresources.com/)